Back to results
US 11,388,169 B2Granted
System and method for outlier and anomaly detection in identity management artificial intelligence systems using cluster based analysis of network identity graphs
AssigneeSailpoint Technologies, Inc.
InventorsMohamed M. Badawy, Jostine Fei Ho
Life of this patent
Estimating the term…
Abstract
Systems and methods for artificial intelligence systems for identity management systems are disclosed. Embodiments may perform outlier detection and risk assessment based on identity management data, including one or more property graphs or peer groups determined from those property graphs, to determine identity management artifacts with ‘abnormal’ patterns when compared to other related identity management artifacts.
Claims21
An identity management system using graphs for risk detection, comprising:
- a memory;
- a hardware processor;
- a non-transitory, computer-readable storage medium including computer instructions executable by the hardware processor for:
- obtaining first identity management data from one or more source systems of an enterprise at a first time;
- evaluating the obtained first identity management data to determine a first set of identities and a first set of entitlements associated with the first set of identities, wherein the first set of identities and the associated first set of entitlements are utilized in identity management in association with the enterprise;
- generating a first graph from the first identity management data by:
- creating a node of the first graph for each of the determined first set of identities,
- for each first identity and second identity from the determined first set of identities that share at least one entitlement of the determined first set of entitlements, creating an edge of the first graph between a first node and a second node of the first graph representing respectively the corresponding first identity and the second identity, and
- generating similarity weights for each of the created edges of the first graph, wherein a weight for the created edge between the first node and the second node is based on the at least one entitlement shared between the corresponding first identity and the second identity represented respectively by the corresponding first node and the second node;
- storing the first graph in a data store;
- analyzing the first graph or the first identity management data to identify an outlier node based upon a pruning a set of edges of the first graph based on the similarity weights of the set of edges;
- and
- identifying an identity management artifact associated with the outlier node as a high risk identity management artifact.
10 more elements
A method for risk detection by using graphs, comprising:
- obtaining first identity management data from one or more source systems of an enterprise at a first time;
- evaluating the obtained first identity management data to determine a first set of identities and a first set of entitlements associated with the first set of identities, wherein the first set of identities and the associated first set of entitlements are utilized in identity management in association with the enterprise;
- generating a first graph from the first identity management data by:
- creating a node of the first graph for each of the determined first set of identities,
- for each first identity and second identity from the determined first set of identities that share at least one entitlement of the determined first set of entitlements, creating an edge of the first graph between a first node and a second node of the first graph representing respectively the corresponding first identity and the second identity, and
- generating similarity weights for each of the created edges of the first graph, wherein a weight for the created edge between the first node and the second node is based on the at least one entitlement shared between the corresponding first identity and the second identity represented respectively by the corresponding first node and the second node;
- storing the first graph in a data store;
- analyzing the first graph or the first identity management data to identify an outlier node based upon a pruning a set of edges of the first graph based on the similarity weights of the set of edges;
- and
- identifying an identity management artifact associated with the outlier node as a high risk identity management artifact.
7 more elements
A non-transitory computer readable storage medium, comprising instructions executable for risk detection by using graphs to perform the steps of:
- obtaining first identity management data from one or more source systems of an enterprise at a first time;
- evaluating the obtained first identity management data to determine a first set of identities and a first set of entitlements associated with the first set of identities, wherein the first set of identities and the associated first set of entitlements are utilized in identity management in association with the enterprise;
- generating a first graph from the first identity management data by:
- creating a node of the first graph for each of the determined first set of identities,
- for each first identity and second identity from the determined first set of identities that share at least one entitlement of the determined first set of entitlements, creating an edge of the first graph between a first node and a second node of the first graph representing respectively the corresponding first identity and the second identity, and
- generating similarity weights for each of the created edges of the first graph, wherein a weight for the created edge between the first node and the second node is based on the at least one entitlement shared between the corresponding first identity and the second identity represented respectively by the corresponding first node and the second node;
- storing the first graph in a data store;
- analyzing the first graph or the first identity management data to identify an outlier node based upon a pruning a set of edges of the first graph based on the similarity weights of the set of edges;
- and
- identifying an identity management artifact associated with the outlier node as a high risk identity management artifact.
7 more elements
Dependencies are inferred from the claim text.